AI Calling Compliance in India (2026): TRAI DLT, DND/NCPR, DPDP & RBI

TRAI's Unsolicited Commercial Communications (UCC) regulations prohibit outbound commercial calls before 09:00 and after 21:00 IST (Indian Standard Time). The restriction applies to the called party's time zone. Violations carry subscriber complaints and operator penalties. The key operational requirement is that no dial — including retries — should leave the platform outside this window, regardless of when a campaign is launched or a retry is scheduled.

• No outbound commercial call may be placed before 09:00 IST or after 21:00 IST.
• The window applies to every dial attempt, including retries and callbacks.
• Violations are reportable by subscribers and carry regulator action against the originating operator.

The Distributed Ledger Technology (DLT) framework, mandated by TRAI, requires commercial SMS and WhatsApp messages to carry a registered Sender ID (PE ID and Header) and to be associated with a pre-approved content template. For outbound voice calls, the DLT requirement primarily covers PE (Principal Entity) registration and the registration of the caller-line identity (the "from" number) under an approved sender header — voice calls are not subject to the same per-message content-template gating as SMS and WhatsApp under the DLT framework. Consult your legal counsel and DLT portal on the current voice-specific requirements for your use case.

• PE (Principal Entity) ID: your company must register on any of the TRAI-mandated DLT portals (Vodafone Idea, Jio, Airtel, BSNL, or TATA).
• Header (Sender ID): the registered caller-line identity (the "from" number) should be associated with an approved sender header under your PE ID.
• Content template (SMS / WhatsApp): for messaging channels, the approved content template must match the registered category (transactional, promotional, or service). Voice calls are governed by consent and calling-window compliance rather than DLT content templates.
• Telemarketer registration: the originating entity placing calls on your behalf must be a registered telemarketer on the DLT platform.

The National Customer Preference Registry (NCPR), commonly called the Do Not Disturb (DND) registry, is TRAI's opt-out list for commercial communications. Subscribers who register on NCPR must not receive commercial calls. The requirement is mandatory — there is no opt-in override. Scrubbing must happen before each dial, not just at list import, because subscribers can register or update their preferences at any time.

• Scrubbing is mandatory before each outbound commercial dial, not a one-time list clean.
• Partial DND registrations (e.g. "no financial calls" but allowing service calls) require category-level matching.
• Operators are required to update their DND seed from TRAI daily.
• There is no "consent overrides DND" exception for most commercial voice categories — NCPR registration takes precedence.

The Digital Personal Data Protection Act 2023 (DPDP) establishes a consent-first framework for processing personal data in India. For AI calling platforms, the most operationally significant requirements are: obtaining a lawful basis (typically consent) before processing a data principal's phone number for commercial outreach, honouring erasure requests, limiting retention to the stated purpose, and keeping data of Indian residents within India or in approved jurisdictions.

• Consent record: a consent action with timestamp must be captured and stored before processing personal contact data for outbound calling.
• Erasure right: a data principal may request deletion of their data; the platform must support deletion of the contact record, associated call logs, and removal from future dials.
• Retention limitation: personal data should not be retained beyond the purpose for which consent was given.
• Data residency: the DPDP Act requires that personal data of Indian residents not be transferred to jurisdictions not approved by the government. Cloud infrastructure serving Indian data should be hosted in India.
• Significant data fiduciary obligations (for large-scale processors) include DPIA, DPO appointment, and additional safeguards — evaluate based on your processing volume.

For non-banking financial companies and regulated lenders, the Reserve Bank of India's Fair Practices Code (FPC) and its guidelines on recovery agents impose specific requirements on collection calls. These include restrictions on call timing (broadly aligned with TRAI windows), prohibition of harassment or misrepresentation, requirements on identifying the calling entity, and restrictions on contacting third parties not authorised by the borrower.

• Calling windows for recovery agents are broadly aligned with TRAI (no calls before 08:00 or after 20:00 per RBI guidance, stricter than TRAI in some interpretations — consult your legal counsel on the applicable standard).
• Recovery agents must identify themselves and the lending institution on every call.
• Calls to references, guarantors, or third parties not designated by the borrower are prohibited under most RBI interpretations.
• Harassment, abusive language, and misrepresentation of the debt amount are prohibited.
• Borrowers who dispute the debt must be given a formal channel to raise the dispute.

Check whether the platform applies calling rules before each dial, including retries and callbacks. A campaign setting that users can turn off gives a different level of protection from a platform gate. Ask the vendor how it handles these checks:

• Calling-window gate: every dial is checked against the 09:00–21:00 IST window before being placed. Retries and callbacks go through the same gate.
• DND scrub: every number is checked against the current DND seed before a dial is issued. Numbers flagged DND are skipped, not just logged.
• Consent capture: a consent action and timestamp are recorded at call open.
• Audit log: every platform action — dial, skip, retry, escalation, consent, opt-out — is written to an immutable, append-only log available for regulator review.
• Opt-out detection: in-call opt-out signals (verbal "remove me from your list") are detected and honoured — the contact is flagged and excluded from future dials automatically.

The following describes Vaanicall's enforcement of the above requirements as shipped features, verified against the current codebase and docs/STATUS.md. These are not aspirational — they are live and tested.

• TRAI calling window: enforced as a hard gate via the `can_dial` function at the orchestrator layer. Every outbound dial, including campaign dials, retries, and inbound-redial callbacks, passes through this gate. A 2,000-case randomized property-style test proves no out-of-window dial can leak through any combination of inputs.
• DND scrub: contacts are checked against the DND registry on CSV import (normalised and deduplicated) and again at dial time. DND-registered numbers are hard-skipped.
• DPDP consent record: consent action and timestamp are captured at call open and written to the audit log. Per-contact data export (DPDP right to access) and erasure (delete contact record + flag DND + audit trail) are implemented as platform APIs.
• Data residency: Vaanicall's infrastructure for Indian customer data is deployed in ap-south-1 (AWS Mumbai region) by default. The platform is India-resident by design for Indian tenant data.
• Audit log: every call action — launch, dial, skip, retry, disposition, consent event, opt-out — is written to a monthly-partitioned, append-only audit log. Records are available for regulator or supervisor review.
• DLT template manager: Vaanicall includes a DLT template manager (shipped as part of the P12 BYOK + DLT feature set). Tenants register their PE ID, sender headers, and content templates for SMS and WhatsApp messaging channels; the send gate blocks unapproved or template-less sends on those channels. Voice calls are governed by the calling-window gate and DND scrub; they are not subject to per-call content-template validation under the DLT send gate.
• Opt-out detection: EN and Hinglish opt-out phrases are detected in-call and converted to a ConsentEvent that sets the contact's DND flag and writes an audit entry.
• AI-disclosure enforcement: per TRAI guidance on AI-generated voice, Vaanicall supports optional in-call AI-disclosure. This is a per-tenant opt-in (default off, configurable in the agent builder). Tenants whose licence or legal counsel requires disclosure can enable it without code changes.

Before launch, agree on which checks the platform performs and which decisions belong to your team. Technical controls cannot replace legal review for your product and licence.

• Platform enforces: calling-window gate (no leaks), DND scrub (hard skip), consent capture, audit log, opt-out detection, data residency, DLT send-gate validation for SMS/WhatsApp channels, DPDP export/erasure APIs.
• Tenant responsible for: DLT registration of your PE ID, headers, and templates on the TRAI DLT portal; ensuring your caller-line identity is registered under your PE ID for voice calls; IRDAI compliance for insurance solicitation calls; RBI FPC script review for collection calls; DPDP lawful basis documentation and DPO appointment (if applicable); obtaining underlying consent from contacts before upload; any NCPR category-level distinctions that apply to your use case.
• Shared (platform + tenant): script review and approval before launch (tenant controls the agent builder; platform provides the guardrails); in-call AI-disclosure configuration (tenant decides, platform enforces if enabled).

TRAI, DPDP, and RBI guidance evolves. This guide is reviewed quarterly against published TRAI circulars, MeitY DPDP implementation notifications, and RBI Master Directions. The "Last updated" date at the top indicates the last review. For time-sensitive regulatory questions, consult your legal counsel — this guide is educational, not legal advice.